Privacy Policy

1. Who we are

Inlay (“we”, “us”, “our”) operates the Inlay platform, accessible at useinlay.com. We provide native ad monetisation services to website publishers. This policy explains what personal data we collect, why, and how you can control it.

2. Data we collect

Account data. When you create an account we collect your name, email address, and (for password accounts) a bcrypt-hashed password. OAuth sign-ins (Google, GitHub) provide your name, email, and profile picture via the provider.

Billing data. Subscription and payment details are handled entirely by Stripe. We store your Stripe customer ID and subscription status but never see full card numbers.

Publisher payout data. For Stripe Connect payouts we store your connected account ID and payout history. Bank account details are held exclusively by Stripe.

Analytics data.We collect aggregated impression and click counts per ad placement. We also record an individual event (page URL, timestamp, event type) each time an ad is shown or clicked on a publisher's site; these per-event records are retained for up to 30 days and then deleted (see Section 5).

End-visitor page data.The Inlay embed script analyses the structure of a publisher's page to generate a matching ad template. Before anything leaves the visitor's browser, all visible text, links, image URLs, and background images are stripped and replaced with placeholders — what's sent describes the page's HTML structure only, never its actual content. This redacted structure may be processed by Anthropic's Claude API (see Section 4) to help choose an ad format; it is not linked to a visitor identity, and no cookie or persistent identifier is created for end visitors.

Technical data.Standard server logs (IP address, user agent, request path, timestamp) retained for up to 30 days for security and debugging. This applies to requests from publishers' end visitors as well as to Inlay account holders — for example, an end visitor's IP address is used briefly to rate-limit ad requests.

3. How we use your data

• To provide, maintain and improve the Inlay platform
• To process subscription billing and publisher payouts
• To send transactional emails (account events, payout notifications, payment alerts)
• To enforce plan limits and prevent abuse
• To comply with legal obligations

We do not sell personal data to third parties. We do not use your data for behavioural advertising.

4. Third-party services

We use the following sub-processors:

• Stripe — payment processing and publisher payouts (USA)
• Vercel — hosting and serverless compute (USA/EU)
• Anthropic — processes a redacted page-structure snapshot (no visible text, links, or images) via the Claude API to generate ad templates (USA)
• Resend — transactional email delivery (USA)
• Sentry — error monitoring (USA/EU)
• Upstash — distributed rate limiting (USA/EU, if configured)

5. Data retention

Account data is retained for the lifetime of your account and deleted within 30 days of account deletion. Aggregated analytics (impression and revenue totals) may be retained for up to 7 years for financial record-keeping. Server logs are deleted after 30 days. Individual ad-event records that include an end visitor's page URL (Section 2, “Analytics data”) are deleted after 30 days by an automated daily process — only the aggregated totals persist beyond that window.

6. Your rights

Under GDPR and equivalent laws you have the right to access, correct, export, or delete the personal data we hold about you. To exercise any of these rights, email privacy@useinlay.com. We will respond within 30 days.

You may delete your account at any time from Settings → Delete account. This permanently removes all your data from our systems.

7. Cookies

We use a single session cookie to keep you logged in. We do not use tracking or advertising cookies. See our Cookie Policy for details.

8. Changes to this policy

We may update this policy from time to time. Material changes will be emailed to registered users at least 14 days in advance. Continued use of the platform after the effective date constitutes acceptance.

9. Contact

For privacy questions or data requests, contact us at privacy@useinlay.com.